A member of the Ryuk ransomware operation will spend the next two years in a US federal prison. Karen Serobovich Vardanyan, a 35-year-old Armenian national, helped break into American companies and lock down their systems. He also received three years of supervised release after he pleaded guilty earlier this year. His case closes one chapter of a gang that took more than $150 million from victims, including hospitals during the pandemic.
Who Is Karen Vardanyan?
Vardanyan went by the online handles “Maneeken” and “Karl Lagerfeld.” His job inside the group was narrow but critical. He focused on initial access, which means he found ways into company networks and opened the door for the rest of the crew. Once he had that foothold, his partners could spread Ryuk ransomware across as many machines as possible.
Authorities arrested him in April 2025 and later sent him from Kyiv, Ukraine, to face charges in the United States. He pleaded guilty in July, and the court has now handed down his sentence. For someone who could have faced up to 15 years behind bars, a 24-month term is a modest outcome.
Inside the Attacks on US Organizations
Court documents place Vardanyan’s activity between March 2019 and around June 2020. During that time, he and his partners breached several US organizations. They then deployed Ryuk ransomware across hundreds of servers and workstations, so the damage reached far beyond a few computers.
The Michigan Payment and Other Victims
One of the clearest examples involves a Michigan company that paid 200 bitcoin to regain control of its systems. At the time, that sum was worth more than $1.1 million. Prosecutors also named a school in Texas and a tech company in Wilsonville, Oregon. Both appear among the targets the Ryuk crew hit with its ransomware.
Across the whole scheme, the US Department of Justice says the group collected around 1,610 bitcoin in ransom payments. That haul was worth more than $15 million when victims paid it. However, the figure covers the entire group’s take rather than money Vardanyan kept for himself. Prosecutors also framed it as an allegation, not a proven total.
Why Initial Access Specialists Matter
Initial access might sound like a minor role, but Ryuk and every major ransomware gang since have depended on it. Attackers cannot lock a network they cannot reach. So the person who finds the first way in sets every later stage in motion. Common entry points include stolen passwords, phishing emails, and weak remote access tools left open on the internet.
Some specialists sell that access to other criminals, and security researchers call them initial access brokers. Others, like Vardanyan, work inside a gang and hand the keys to trusted partners. Either way, this split lets Ryuk and similar ransomware crews grow fast, because the break-in and the extortion become separate jobs.
A Look Back at the Ryuk Ransomware Operation
Ryuk ran as a ransomware-as-a-service operation from August 2018 until mid-2020. It earned a grim reputation after it launched a wave of attacks on healthcare providers during COVID-19. Hospitals had almost no room for downtime at that point. That choice of targets made the gang one of the most notorious of its time.
At its peak, the gang behind Ryuk ransomware hit around 20 victims every week. It also collected more than $150 million in ransom payments during its run. Those numbers placed Ryuk among the most profitable extortion groups of its era. They also explain why police kept chasing its members years after it went quiet.
From Ryuk to Conti and Beyond
The Wizard Spider cybercrime group ran Ryuk, and it did not vanish when the operation shut down in 2020. Instead, the same crew moved to Conti, which soon grew into one of the busiest ransomware gangs in the world. Conti then fell apart in 2022 after its internal chats and source code leaked in May.
However, the collapse did not end the threat, since former Conti members split into smaller units that joined other gangs or launched new ones. Many of the people and tools behind Ryuk simply moved into fresh ransomware brands. As a result, their tactics still live on in groups that remain active today.
What This Case Means for Businesses and Users
Law enforcement took years to catch up with Vardanyan, but the case proves that attackers can face consequences long after a breach. His transfer from Ukraine also depended on international teamwork. That matters because many ransomware operators live far outside US reach. Still, a two-year sentence may feel small to victims who paid millions to get their data back.
For businesses, the lesson centers on the first step of the attack. Strong passwords, multi-factor authentication, and quick patching all make an access specialist’s job much harder. Companies should also avoid leaving remote desktop tools open to the internet. Instead, they can route remote access through a secure, encrypted connection such as a business VPN.
Home users face related risks, since stolen logins often start with one reused password or a convincing phishing email. A password manager, careful email habits, and a trusted VPN on public Wi-Fi all make it harder for criminals to grab your details. These steps will not stop every attack, but they close the easy doors that access brokers look for first.
Final Thoughts
Vardanyan’s sentence brings some accountability for one piece of the Ryuk ransomware machine, even if the punishment looks small next to the money involved. His case also puts attention back on the quiet first step behind every major attack. Ryuk may be gone, but its successors still use the same entry tricks. Defenders who lock down access today will stay ahead of whoever picks up that playbook next.
